@wizeworks/lens-cloud 0.3.0-alpha.1 → 0.3.0-alpha.2

package/dist/auth/sso.js

@@ -0,0 +1,35 @@
+import { sso } from "@better-auth/sso";
+import { audit } from "../repo/audit.js";
+import { ssoSchema } from "./schema-names.js";
+/** The DNS record that proves a domain: `_wizelens-sso-<providerId>.<domain>` TXT `<token>`. */
+export const SSO_TOKEN_PREFIX = "wizelens-sso";
+/** The SSO provider behind a new account, when Better Auth makes it from a single sign-on. */
+export function ssoProviderOf(source) {
+    const s = source;
+    return s?.method?.startsWith("sso-") && typeof s.sso?.providerId === "string" ? s.sso.providerId : undefined;
+}
+/** True when an organization's provider has a proven domain and the email is at exactly that domain. */
+export async function ssoTrusts(db, providerId, email) {
+    const p = await db.findOne({ model: "ssoProvider", where: [{ field: "providerId", value: providerId }] });
+    const at = email.trim().toLowerCase().split("@")[1] ?? "";
+    const domains = (p?.domain ?? "").toLowerCase().split(",").map((d) => d.trim());
+    return !!p?.organizationId && p.domainVerified === true && !!at && domains.includes(at);
+}
+/** Organization SSO with OIDC or SAML. Sign-in works once the domain is proven in DNS; new people join that organization as members. */
+export function ssoPlugin(deps) {
+    return sso({
+        schema: ssoSchema,
+        providersLimit: 20,
+        domainVerification: { enabled: true, tokenPrefix: SSO_TOKEN_PREFIX },
+        organizationProvisioning: {
+            defaultRole: "member",
+            getRole: async ({ user, provider }) => {
+                if (provider.organizationId)
+                    await audit(deps.db, provider.organizationId, `user:${user.id}`, "member.join", { via: "sso", providerId: provider.providerId }, Date.now());
+                return "member";
+            },
+        },
+        saml: { enableInResponseToValidation: true, allowIdpInitiated: false, requireTimestamps: true, clockSkew: 2 * 60_000, algorithms: { onDeprecated: "reject" } },
+    });
+}
+//# sourceMappingURL=sso.js.map

package/dist/auth/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../src/auth/sso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAY/C,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,CAAC,GAAG,MAAyE,CAAC;IACpF,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/G,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,UAAkB,EAAE,KAAa;IAC3E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,OAAO,CAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACvH,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,OAAO,GAAG,CAAC;QACT,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE,EAAE;QAClB,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE;QACpE,wBAAwB,EAAE;YACxB,WAAW,EAAE,QAAQ;YACrB,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACpC,IAAI,QAAQ,CAAC,cAAc;oBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC1K,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF;QACD,IAAI,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE;KAC/J,CAAgC,CAAC;AACpC,CAAC"}

package/dist/auth/wire.d.ts

@@ -0,0 +1,16 @@
+import type { CloudConfig } from "../config.js";
+import type { Db } from "../db/db.js";
+import type { Mailer } from "../mail/mailer.js";
+import { type WizeAuth } from "./auth.js";
+import { type AuthSecret } from "./secret.js";
+export interface AuthWiring {
+    /** Build Better Auth for the address the cloud listens on. */
+    start(listenUrl: string): WizeAuth;
+    /** The first account's link while no account exists, else null. */
+    setupLink(): string | null;
+    /** The auth secrets, newest first. Unsubscribe links are signed with them too. */
+    secrets: AuthSecret[];
+}
+/** Secrets, the setup gate, and the rest Better Auth needs; Better Auth itself starts once the address is known. */
+export declare function wireAuth(db: Db, config: CloudConfig, mailer: Mailer): Promise<AuthWiring>;
+//# sourceMappingURL=wire.d.ts.map

package/dist/auth/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,aAAa,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IACnC,mEAAmE;IACnE,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,kFAAkF;IAClF,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAgBD,oHAAoH;AACpH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2B/F"}

package/dist/auth/wire.js

@@ -0,0 +1,47 @@
+import { randomBytes } from "node:crypto";
+import { userCount } from "../repo/users.js";
+import { createAuth } from "./auth.js";
+import { clearAuthEnv, resolveSecrets } from "./secret.js";
+/** The one-time setup token: from the config, or new. Gone once the first account exists. */
+async function setupGate(db, configured) {
+    let open = (await userCount(db)) === 0;
+    const token = configured ?? randomBytes(24).toString("base64url");
+    return { token: () => (open ? token : null), done: () => void (open = false) };
+}
+/** The public origin, plus 127.0.0.1 next to localhost (or the reverse) when the cloud runs on its default local address. */
+function originsOf(publicUrl, local) {
+    const origin = new URL(publicUrl).origin;
+    if (!local)
+        return [origin];
+    return [origin, origin.includes("//localhost") ? origin.replace("//localhost", "//127.0.0.1") : origin.replace("//127.0.0.1", "//localhost")];
+}
+/** Secrets, the setup gate, and the rest Better Auth needs; Better Auth itself starts once the address is known. */
+export async function wireAuth(db, config, mailer) {
+    clearAuthEnv();
+    const [secrets, setup] = await Promise.all([resolveSecrets(db, config.authSecret), setupGate(db, config.setupToken)]);
+    let base = config.publicUrl;
+    return {
+        secrets,
+        start: (listenUrl) => {
+            base = config.publicUrl ?? listenUrl.replace("//127.0.0.1", "//localhost");
+            const deps = {
+                db,
+                publicUrl: new URL(base).origin,
+                trustedOrigins: originsOf(base, !config.publicUrl),
+                ssoOrigins: config.ssoOrigins,
+                secrets,
+                signup: config.signup,
+                mailer,
+                setup,
+                checkPwned: config.checkPwnedPasswords ?? db.kind === "postgres",
+                retentionDays: config.retentionDays,
+            };
+            return createAuth(deps);
+        },
+        setupLink: () => {
+            const token = setup.token();
+            return token && base ? `${base}/_wizelens/#/setup?token=${token}` : null;
+        },
+    };
+}
+//# sourceMappingURL=wire.js.map

package/dist/auth/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../src/auth/wire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAmB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAW5E,6FAA6F;AAC7F,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,UAA8B;IAC7D,IAAI,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,6HAA6H;AAC7H,SAAS,SAAS,CAAC,SAAiB,EAAE,KAAc;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAChJ,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,MAAmB,EAAE,MAAc;IACxE,YAAY,EAAE,CAAC;IACf,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,OAAO;QACL,OAAO;QACP,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE;YACnB,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAa;gBACrB,EAAE;gBACF,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC/B,cAAc,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;gBAClD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO;gBACP,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM;gBACN,KAAK;gBACL,UAAU,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU;gBAChE,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC;YACF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,4BAA4B,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli-args.d.ts

@@ -1,5 +1,5 @@
 import type { CloudOptions } from "./config.js";
-export declare const USAGE = "wizelens-cloud: the WizeLens service for many teams.\n\nUsage: wizelens-cloud [options]\n\n  --database <url>          postgres://..., pglite:<folder>, or memory.\n                            Default pglite:./.wizelens-cloud.          (DATABASE_URL)\n  --port <n>                Default 5970.                               (PORT)\n  --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)\n  --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)\n  --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)\n  --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)\n  --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)\n  --help                    Show this help.\n";
+export declare const USAGE = "wizelens-cloud: the WizeLens service for many teams.\n\nUsage: wizelens-cloud [options]\n\n  --database <url>          postgres://..., pglite:<folder>, or memory.\n                            Default pglite:./.wizelens-cloud.          (DATABASE_URL)\n  --port <n>                Default 5970.                               (PORT)\n  --host <addr>             Default 0.0.0.0.                            (WIZELENS_CLOUD_HOST)\n  --public-url <url>        The address people use, for links.          (WIZELENS_CLOUD_PUBLIC_URL)\n  --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)\n  --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)\n  --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)\n  --auth-secret <text>      Signs sessions, encrypts 2FA secrets. 32+   (WIZELENS_CLOUD_AUTH_SECRET)\n                            characters; \"2:new,1:old\" rotates.\n                            Required with Postgres.\n  --resend-api-key <key>    Outgoing mail through Resend (re_...).      (WIZELENS_CLOUD_RESEND_API_KEY)\n                            Needs --public-url.\n  --resend-webhook-secret <s>  The Resend webhook's whsec_ secret:     (WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET)\n                            bounces and complaints stop later mail.\n                            Webhook URL: <public-url>/_wizelens/api/mail/resend\n  --smtp-url <url>          Or mail over SMTP: smtp://user:pass@host:587 (WIZELENS_CLOUD_SMTP_URL)\n                            or smtps://...:465. Needs --public-url.\n  --mail-from <address>     Sender, e.g. \"WizeLens <a@b.com>\".          (WIZELENS_CLOUD_MAIL_FROM)\n  --trust-proxy             Read the client address from the last       (WIZELENS_CLOUD_TRUST_PROXY=1)\n                            X-Forwarded-For entry (your own proxy only).\n  --setup-token <text>      The first account's token. Default: random, (WIZELENS_CLOUD_SETUP_TOKEN)\n                            printed at start while no account exists.\n  --check-pwned-passwords   Refuse breached passwords. Default on with  (WIZELENS_CLOUD_CHECK_PWNED=1|0)\n  --no-check-pwned-passwords Postgres, off with PGlite.\n  --sso-origins <list>      Identity provider origins for OIDC single   (WIZELENS_CLOUD_SSO_ORIGINS)\n                            sign-on, comma separated, for example\n                            https://acme.okta.com. SAML needs none.\n  --help                    Show this help.\n";
 /** Options from the command line, then from the environment. */
 export declare function optionsFromArgs(argv: string[], env: NodeJS.ProcessEnv): CloudOptions | "help";
 //# sourceMappingURL=cli-args.d.ts.map

package/dist/cli-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,KAAK,83BAajB,CAAC;AAKF,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,YAAY,GAAG,MAAM,CAwB7F"}
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAE5D,eAAO,MAAM,KAAK,y/EAiCjB,CAAC;AAgCF,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,YAAY,GAAG,MAAM,CAqB7F"}

package/dist/cli-args.js

@@ -11,35 +11,76 @@ Usage: wizelens-cloud [options]
   --signup <invite|open>    Who can make an account. Default invite.    (WIZELENS_CLOUD_SIGNUP)
   --retention-days <n>      Default for new organizations. Default 30.  (WIZELENS_CLOUD_RETENTION_DAYS)
   --allow-private-webhooks  Let alert webhooks reach private addresses. (WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS=1)
+  --auth-secret <text>      Signs sessions, encrypts 2FA secrets. 32+   (WIZELENS_CLOUD_AUTH_SECRET)
+                            characters; "2:new,1:old" rotates.
+                            Required with Postgres.
+  --resend-api-key <key>    Outgoing mail through Resend (re_...).      (WIZELENS_CLOUD_RESEND_API_KEY)
+                            Needs --public-url.
+  --resend-webhook-secret <s>  The Resend webhook's whsec_ secret:     (WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET)
+                            bounces and complaints stop later mail.
+                            Webhook URL: <public-url>/_wizelens/api/mail/resend
+  --smtp-url <url>          Or mail over SMTP: smtp://user:pass@host:587 (WIZELENS_CLOUD_SMTP_URL)
+                            or smtps://...:465. Needs --public-url.
+  --mail-from <address>     Sender, e.g. "WizeLens <a@b.com>".          (WIZELENS_CLOUD_MAIL_FROM)
+  --trust-proxy             Read the client address from the last       (WIZELENS_CLOUD_TRUST_PROXY=1)
+                            X-Forwarded-For entry (your own proxy only).
+  --setup-token <text>      The first account's token. Default: random, (WIZELENS_CLOUD_SETUP_TOKEN)
+                            printed at start while no account exists.
+  --check-pwned-passwords   Refuse breached passwords. Default on with  (WIZELENS_CLOUD_CHECK_PWNED=1|0)
+  --no-check-pwned-passwords Postgres, off with PGlite.
+  --sso-origins <list>      Identity provider origins for OIDC single   (WIZELENS_CLOUD_SSO_ORIGINS)
+                            sign-on, comma separated, for example
+                            https://acme.okta.com. SAML needs none.
   --help                    Show this help.
 `;
 const int = (v) => (v && /^\d+$/.test(v) ? Number(v) : undefined);
 const signupOf = (v) => (v === "open" || v === "invite" ? v : undefined);
+const text = (...v) => v.find((x) => x !== undefined && x !== "");
+const list = (v) => v?.split(",").map((s) => s.trim()).filter(Boolean);
+const flag = (v) => (v === "1" || v === "true" ? true : v === "0" || v === "false" ? false : undefined);
+const OPTIONS = {
+    database: { type: "string" },
+    port: { type: "string" },
+    host: { type: "string" },
+    "public-url": { type: "string" },
+    signup: { type: "string" },
+    "retention-days": { type: "string" },
+    "allow-private-webhooks": { type: "boolean" },
+    "auth-secret": { type: "string" },
+    "smtp-url": { type: "string" },
+    "resend-api-key": { type: "string" },
+    "resend-webhook-secret": { type: "string" },
+    "mail-from": { type: "string" },
+    "trust-proxy": { type: "boolean" },
+    "setup-token": { type: "string" },
+    "check-pwned-passwords": { type: "boolean" },
+    "no-check-pwned-passwords": { type: "boolean" },
+    "sso-origins": { type: "string" },
+    help: { type: "boolean", short: "h" },
+};
+const pwnedOf = (a, env) => a["no-check-pwned-passwords"] ? false : (a["check-pwned-passwords"] ?? flag(env.WIZELENS_CLOUD_CHECK_PWNED));
 /** Options from the command line, then from the environment. */
 export function optionsFromArgs(argv, env) {
-    const { values: a } = parseArgs({
-        args: argv,
-        options: {
-            database: { type: "string" },
-            port: { type: "string" },
-            host: { type: "string" },
-            "public-url": { type: "string" },
-            signup: { type: "string" },
-            "retention-days": { type: "string" },
-            "allow-private-webhooks": { type: "boolean" },
-            help: { type: "boolean", short: "h" },
-        },
-    });
+    const { values: a } = parseArgs({ args: argv, options: OPTIONS });
     if (a.help)
         return "help";
     return {
         database: a.database ?? env.DATABASE_URL,
         port: int(a.port ?? env.PORT),
         host: a.host ?? env.WIZELENS_CLOUD_HOST,
-        publicUrl: a["public-url"] ?? env.WIZELENS_CLOUD_PUBLIC_URL,
+        publicUrl: text(a["public-url"], env.WIZELENS_CLOUD_PUBLIC_URL),
         signup: signupOf(a.signup ?? env.WIZELENS_CLOUD_SIGNUP),
         retentionDays: int(a["retention-days"] ?? env.WIZELENS_CLOUD_RETENTION_DAYS),
         allowPrivateWebhooks: a["allow-private-webhooks"] ?? env.WIZELENS_CLOUD_ALLOW_PRIVATE_WEBHOOKS === "1",
+        authSecret: text(a["auth-secret"], env.WIZELENS_CLOUD_AUTH_SECRET),
+        smtpUrl: text(a["smtp-url"], env.WIZELENS_CLOUD_SMTP_URL),
+        resendApiKey: text(a["resend-api-key"], env.WIZELENS_CLOUD_RESEND_API_KEY),
+        resendWebhookSecret: text(a["resend-webhook-secret"], env.WIZELENS_CLOUD_RESEND_WEBHOOK_SECRET),
+        mailFrom: text(a["mail-from"], env.WIZELENS_CLOUD_MAIL_FROM),
+        trustProxy: a["trust-proxy"] ?? env.WIZELENS_CLOUD_TRUST_PROXY === "1",
+        setupToken: text(a["setup-token"], env.WIZELENS_CLOUD_SETUP_TOKEN),
+        checkPwnedPasswords: pwnedOf(a, env),
+        ssoOrigins: list(text(a["sso-origins"], env.WIZELENS_CLOUD_SSO_ORIGINS)),
     };
 }
 //# sourceMappingURL=cli-args.js.map

package/dist/cli-args.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAapB,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACtF,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAA0B,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAErH,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,GAAsB;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC;QAC9B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY;QACxC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,mBAAmB;QACvC,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,yBAAyB;QAC3D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,qBAAqB,CAAC;QACvD,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,6BAA6B,CAAC;QAC5E,oBAAoB,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC,qCAAqC,KAAK,GAAG;KACvG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCpB,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACtF,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAA0B,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAyB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1F,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC3F,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE5H,MAAM,OAAO,GAAG;IACd,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3C,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5C,0BAA0B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;CAC7B,CAAC;AAEX,MAAM,OAAO,GAAG,CAAC,CAA8E,EAAE,GAAsB,EAAE,EAAE,CACzH,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAE/G,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,GAAsB;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY;QACxC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,mBAAmB;QACvC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,yBAAyB,CAAC;QAC/D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,qBAAqB,CAAC;QACvD,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,6BAA6B,CAAC;QAC5E,oBAAoB,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC,qCAAqC,KAAK,GAAG;QACtG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC;QAClE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,uBAAuB,CAAC;QACzD,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,6BAA6B,CAAC;QAC1E,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,CAAC,oCAAoC,CAAC;QAC/F,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,wBAAwB,CAAC;QAC5D,UAAU,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,KAAK,GAAG;QACtE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC;QAClE,mBAAmB,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC;QACpC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/cli.js

@@ -1,6 +1,22 @@
 #!/usr/bin/env node
 import { optionsFromArgs, USAGE } from "./cli-args.js";
 import { CLOUD_VERSION, createCloud } from "./server.js";
+function notes(cloud) {
+    const { app } = cloud;
+    const out = [];
+    if (app.db.kind === "pglite")
+        out.push("  Note: PGlite is for trials and tests. Use Postgres for real teams.");
+    if (!app.mailer.live)
+        out.push("  Note: no --resend-api-key or --smtp-url, so emails are written to this log and email addresses are not confirmed.");
+    if (app.mailer.via === "resend" && !app.config.resendWebhookSecret)
+        out.push("  Note: no --resend-webhook-secret, so bounced addresses keep getting mail.");
+    if (app.db.kind === "postgres" && !app.config.publicUrl?.startsWith("https://"))
+        out.push("  Note: set --public-url to an https:// address, so sign-in cookies are Secure.");
+    const setup = cloud.setupLink();
+    if (setup)
+        out.push("", "  No account yet. Open this link to make the first one (it works once):", `  ${setup}`);
+    return out;
+}
 async function main() {
     const options = optionsFromArgs(process.argv.slice(2), process.env);
     if (options === "help")
@@ -14,9 +30,9 @@ async function main() {
         `  Add-ons     WIZELENS_HUB=${url}  WIZELENS_HUB_TOKEN=<ingest key>`,
         `  OTLP/HTTP   OTEL_EXPORTER_OTLP_ENDPOINT=${url}  (header Authorization=Bearer <ingest key>)`,
         `  Database    ${db}`,
+        `  Mail        ${{ resend: "Resend", smtp: "SMTP", test: "test sender", log: "log only" }[cloud.app.mailer.via]}`,
+        ...notes(cloud),
     ].join("\n"));
-    if (cloud.app.db.kind === "pglite")
-        console.info("  Note: PGlite is for trials and tests. Use Postgres for real teams.");
     const stop = () => void cloud.close().then(() => process.exit(0));
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;IACnG,OAAO,CAAC,IAAI,CACV;QACE,kBAAkB,aAAa,EAAE;QACjC,iBAAiB,GAAG,aAAa;QACjC,8BAA8B,GAAG,mCAAmC;QACpE,6CAA6C,GAAG,8CAA8C;QAC9F,iBAAiB,EAAE,EAAE;KACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAc,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAErE,SAAS,KAAK,CAAC,KAAY;IACzB,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IAC/G,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,qHAAqH,CAAC,CAAC;IACtJ,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB;QAAE,GAAG,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC5J,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC7K,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,yEAAyE,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;IACjH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC;IACnG,OAAO,CAAC,IAAI,CACV;QACE,kBAAkB,aAAa,EAAE;QACjC,iBAAiB,GAAG,aAAa;QACjC,8BAA8B,GAAG,mCAAmC;QACpE,6CAA6C,GAAG,8CAA8C;QAC9F,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACjH,GAAG,KAAK,CAAC,KAAK,CAAC;KAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+import type { Mail } from "./mail/mailer.js";
 export type SignupMode = "open" | "invite";
 export interface CloudOptions {
     /** "postgres://...", "pglite:<folder>", or "memory". Default "pglite:./.wizelens-cloud". */
@@ -18,16 +19,37 @@ export interface CloudOptions {
     alertIntervalMs?: number;
     /** Let alert webhooks call private and local addresses, and plain http. For self-hosting on a private network. Default false. */
     allowPrivateWebhooks?: boolean;
+    /** Outgoing mail: "smtp://user:pass@host:587" (STARTTLS) or "smtps://user:pass@host:465". Without it, mail is written to the log. */
+    smtpUrl?: string;
+    /** Outgoing mail through the Resend API (a `re_` key). Used in place of `smtpUrl`. */
+    resendApiKey?: string;
+    /** The `whsec_` signing secret of the Resend webhook, so bounces and spam complaints reach the suppression list. */
+    resendWebhookSecret?: string;
+    /** The sender of every email, for example "WizeLens <alerts@example.com>". */
+    mailFrom?: string;
+    /** Take the client address from X-Forwarded-For (behind a proxy you run). Default false. */
+    trustProxy?: boolean;
+    /** Signs sessions and encrypts 2FA secrets: 32+ random characters, or "2:new,1:old" to rotate. Required with Postgres. */
+    authSecret?: string;
+    /** The one-time token the first account needs. Default: a new random one, printed at start while no account exists. */
+    setupToken?: string;
+    /** Refuse passwords found in known breaches (sends a 5-character hash prefix to api.pwnedpasswords.com). Default: on with Postgres. */
+    checkPwnedPasswords?: boolean;
+    /** Identity provider origins for OIDC single sign-on, for example https://acme.okta.com. The cloud fetches OIDC settings only from these. */
+    ssoOrigins?: string[];
     redactKeys?: string[];
     uiDir?: string;
-    /** For tests: the clock and the HTTP client alerts use. */
+    /** For tests: the clock, the HTTP client alerts use, and a mail sender in place of SMTP. */
     now?: () => number;
     fetch?: typeof fetch;
+    sendMail?: (mail: Mail) => Promise<void>;
+    /** For tests: false keeps background jobs off, so a test runs them itself. Default true. */
+    jobs?: boolean;
 }
-export type CloudConfig = Required<Omit<CloudOptions, "uiDir" | "publicUrl">> & {
-    uiDir: string | undefined;
-    publicUrl: string | undefined;
+type Optional = "uiDir" | "publicUrl" | "smtpUrl" | "resendApiKey" | "resendWebhookSecret" | "sendMail" | "authSecret" | "setupToken" | "checkPwnedPasswords";
+export type CloudConfig = Required<Omit<CloudOptions, Optional>> & Pick<CloudOptions, Optional> & {
     secureCookies: boolean;
 };
 export declare function resolveConfig(o?: CloudOptions): CloudConfig;
+export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iIAAiI;IACjI,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAErK,wBAAgB,aAAa,CAAC,CAAC,GAAE,YAAiB,GAAG,WAAW,CAiB/D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iIAAiI;IACjI,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qIAAqI;IACrI,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oHAAoH;IACpH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0HAA0H;IAC1H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uHAAuH;IACvH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uIAAuI;IACvI,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6IAA6I;IAC7I,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,KAAK,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,GAAG,qBAAqB,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,qBAAqB,CAAC;AAC9J,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC;AAqB7H,wBAAgB,aAAa,CAAC,CAAC,GAAE,YAAiB,GAAG,WAAW,CA6B/D"}

package/dist/config.js

@@ -1,5 +1,29 @@
 import { DEFAULT_REDACT_KEYS } from "@wizeworks/lens-core";
+/** Mail links must use the public address: a link built from the request's Host header could point anywhere. */
+function checkMail(o) {
+    if ((o.smtpUrl || o.resendApiKey) && !o.publicUrl)
+        throw new Error("Sending mail needs --public-url, so links in emails point at this cloud.");
+    if (o.smtpUrl && o.resendApiKey)
+        throw new Error("Pick one mail service: --resend-api-key or --smtp-url, not both.");
+    if (o.smtpUrl && !/^smtps?:\/\//.test(o.smtpUrl))
+        throw new Error("--smtp-url must start with smtp:// or smtps://.");
+    if (o.resendApiKey && !o.resendApiKey.startsWith("re_"))
+        throw new Error("--resend-api-key must be a Resend API key (it starts with re_).");
+    if (o.resendWebhookSecret && !o.resendWebhookSecret.startsWith("whsec_"))
+        throw new Error("--resend-webhook-secret must start with whsec_.");
+}
+/** Each SSO origin as a bare origin: https, or http on this machine only. */
+function ssoOriginsOf(list) {
+    return list.map((raw) => {
+        const url = URL.canParse(raw) ? new URL(raw) : null;
+        const local = url?.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if (!url || (url.protocol !== "https:" && !local) || raw.includes("*"))
+            throw new Error(`--sso-origins: "${raw}" must be an https:// origin, like https://acme.okta.com.`);
+        return url.origin;
+    });
+}
 export function resolveConfig(o = {}) {
+    checkMail(o);
     return {
         database: o.database ?? "pglite:./.wizelens-cloud",
         port: o.port ?? 5970,
@@ -10,6 +34,17 @@ export function resolveConfig(o = {}) {
         ingestPerMinute: o.ingestPerMinute ?? 1200,
         alertIntervalMs: o.alertIntervalMs ?? 60_000,
         allowPrivateWebhooks: o.allowPrivateWebhooks ?? false,
+        smtpUrl: o.smtpUrl,
+        resendApiKey: o.resendApiKey,
+        resendWebhookSecret: o.resendWebhookSecret,
+        mailFrom: o.mailFrom ?? `WizeLens <no-reply@${o.publicUrl ? new URL(o.publicUrl).hostname : "localhost"}>`,
+        trustProxy: o.trustProxy ?? false,
+        sendMail: o.sendMail,
+        jobs: o.jobs ?? true,
+        authSecret: o.authSecret,
+        setupToken: o.setupToken,
+        checkPwnedPasswords: o.checkPwnedPasswords,
+        ssoOrigins: ssoOriginsOf(o.ssoOrigins ?? []),
         redactKeys: o.redactKeys ?? [...DEFAULT_REDACT_KEYS],
         uiDir: o.uiDir,
         now: o.now ?? Date.now,

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAgC3D,MAAM,UAAU,aAAa,CAAC,CAAC,GAAiB,EAAE;IAChD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,0BAA0B;QAClD,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE;QACpC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;QAC1C,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,MAAM;QAC5C,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,KAAK;QACrD,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,mBAAmB,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK;QACvB,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAuD3D,gHAAgH;AAChH,SAAS,SAAS,CAAC,CAAe;IAChC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC/I,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC5I,IAAI,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AAC/I,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAuB;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,KAAK,GAAG,GAAG,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,2DAA2D,CAAC,CAAC;QAC3K,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAC,GAAiB,EAAE;IAChD,SAAS,CAAC,CAAC,CAAC,CAAC;IACb,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,0BAA0B;QAClD,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ;QAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE;QACpC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;QAC1C,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,MAAM;QAC5C,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,KAAK;QACrD,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,sBAAsB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG;QAC1G,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,KAAK;QACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QAC5C,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,mBAAmB,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK;QACvB,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/db/db.d.ts

@@ -1,3 +1,4 @@
+import type { BetterAuthOptions } from "better-auth";
 /** Something that runs SQL: the database, or one transaction. Postgres syntax, `$1` parameters. */
 export interface Queryable {
     query<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
@@ -5,14 +6,16 @@ export interface Queryable {
 export interface Db extends Queryable {
     /** Run `fn` in one transaction. It rolls back when `fn` throws. */
     tx<T>(fn: (q: Queryable) => Promise<T>): Promise<T>;
-    /** Run several statements without parameters (migrations). */
+    /** Run several statements without parameters (migrations, before anything else uses the database). */
     exec(sql: string): Promise<void>;
     close(): Promise<void>;
     readonly kind: "postgres" | "pglite";
+    /** The same database, for Better Auth. */
+    readonly authDatabase: NonNullable<BetterAuthOptions["database"]>;
 }
 /** A managed Postgres, from a `postgres://` URL. */
 export declare function openPostgres(url: string): Promise<Db>;
-/** Postgres in this process (PGlite): a folder on disk, or memory when `dir` is undefined. For tests and trials. */
+/** PGlite (a folder, or memory), for tests and trials. All queries share one Kysely queue with Better Auth: PGlite has one connection. */
 export declare function openPglite(dir?: string): Promise<Db>;
 /** "postgres://..." opens Postgres; "pglite:<folder>" or "memory" opens PGlite. */
 export declare function openDb(url: string): Promise<Db>;

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAGA,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,EAAG,SAAQ,SAAS;IACnC,mEAAmE;IACnE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,8DAA8D;IAC9D,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;CACtC;AAMD,oDAAoD;AACpD,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAwB3D;AAED,oHAAoH;AACpH,wBAAsB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAa1D;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAK/C"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrD,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,EAAG,SAAQ,SAAS;IACnC,mEAAmE;IACnE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,sGAAsG;IACtG,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;CACnE;AAMD,oDAAoD;AACpD,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAyB3D;AAED,0IAA0I;AAC1I,wBAAsB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAmB1D;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAK/C"}

package/dist/db/db.js

@@ -8,6 +8,7 @@ export async function openPostgres(url) {
     const pool = new pg.Pool({ connectionString: url, max: 10 });
     return {
         kind: "postgres",
+        authDatabase: pool,
         ...wrap(pool),
         async tx(fn) {
             const client = await pool.connect();
@@ -29,19 +30,25 @@ export async function openPostgres(url) {
         close: () => pool.end(),
     };
 }
-/** Postgres in this process (PGlite): a folder on disk, or memory when `dir` is undefined. For tests and trials. */
+/** PGlite (a folder, or memory), for tests and trials. All queries share one Kysely queue with Better Auth: PGlite has one connection. */
 export async function openPglite(dir) {
-    const { PGlite: Lite } = await import("@electric-sql/pglite");
-    const lite = await Lite.create(dir);
-    const q = (runner) => ({
-        query: async (sql, params = []) => (await runner.query(sql, params)).rows,
+    const [{ PGlite }, { Kysely, CompiledQuery }, { PGliteDialect }] = await Promise.all([
+        import("@electric-sql/pglite"),
+        import("kysely"),
+        import("kysely-pglite-dialect"),
+    ]);
+    const lite = await PGlite.create(dir);
+    const kysely = new Kysely({ dialect: new PGliteDialect(lite) });
+    const run = (k) => ({
+        query: async (sql, params = []) => (await k.executeQuery(CompiledQuery.raw(sql, params))).rows,
     });
     return {
         kind: "pglite",
-        ...q(lite),
-        tx: (fn) => lite.transaction((t) => fn(q(t))),
+        authDatabase: { db: kysely, type: "postgres", transaction: true },
+        ...run(kysely),
+        tx: (fn) => kysely.transaction().execute((t) => fn(run(t))),
         exec: async (sql) => void (await lite.exec(sql)),
-        close: () => lite.close(),
+        close: () => kysely.destroy(),
     };
 }
 /** "postgres://..." opens Postgres; "pglite:<folder>" or "memory" opens PGlite. */

package/dist/db/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAiBA,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAa,EAAE,CAAC,CAAC;IACtD,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAW;CACvG,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,GAAG,IAAI,CAAC,IAAI,CAAC;QACb,KAAK,CAAC,EAAE,CAAI,EAAgC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY;IAC3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAW,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,MAA6B,EAAa,EAAE,CAAC,CAAC;QACvD,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI;KACnG,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,CAAI,EAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oDAAoD,CAAC,CAAC;AACpG,CAAC"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAoBA,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAa,EAAE,CAAC,CAAC;IACtD,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAW;CACvG,CAAC,CAAC;AAEH,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,IAAI;QAClB,GAAG,IAAI,CAAC,IAAI,CAAC;QACb,KAAK,CAAC,EAAE,CAAI,EAAgC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,0IAA0I;AAC1I,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY;IAC3C,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnF,MAAM,CAAC,sBAAsB,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC;QAChB,MAAM,CAAC,uBAAuB,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAoB,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,CAAC,CAAyC,EAAa,EAAE,CAAC,CAAC;QACrE,KAAK,EAAE,KAAK,EAAK,GAAW,EAAE,MAAM,GAAc,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAI,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KACxH,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE;QACjE,GAAG,GAAG,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,CAAI,EAAgC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oDAAoD,CAAC,CAAC;AACpG,CAAC"}

package/dist/db/migrate.d.ts

@@ -1,6 +1,6 @@
 import type { Db } from "./db.js";
 /** Apply every migration not applied yet, each in its own transaction. Returns how many ran. */
 export declare function migrate(db: Db): Promise<number>;
-/** One migration as single statements, so it runs inside a transaction on every driver. */
-export declare const splitStatements: (sql: string) => string[];
+/** One migration as single statements, so it runs inside a transaction on every driver. A `$$ … $$` body (a function) stays whole. */
+export declare function splitStatements(sql: string): string[];
 //# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAGlC,gGAAgG;AAChG,wBAAsB,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAcrD;AAED,2FAA2F;AAC3F,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,MAAM,EAIhC,CAAC"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAGlC,gGAAgG;AAChG,wBAAsB,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAcrD;AAED,sIAAsI;AACtI,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAWrD"}

package/dist/db/migrate.js

@@ -17,9 +17,19 @@ export async function migrate(db) {
     }
     return ran;
 }
-/** One migration as single statements, so it runs inside a transaction on every driver. */
-export const splitStatements = (sql) => sql
-    .split(/;\s*\n/)
-    .map((s) => s.trim().replace(/;$/, ""))
-    .filter(Boolean);
+/** One migration as single statements, so it runs inside a transaction on every driver. A `$$ … $$` body (a function) stays whole. */
+export function splitStatements(sql) {
+    const out = [];
+    let current = "";
+    let quoted = false;
+    for (const line of sql.split("\n")) {
+        current += `${line}\n`;
+        if ((line.match(/\$\$/g)?.length ?? 0) % 2 === 1)
+            quoted = !quoted;
+        if (!quoted && /;\s*$/.test(line))
+            (out.push(current), (current = ""));
+    }
+    out.push(current);
+    return out.map((s) => s.trim().replace(/;$/, "")).filter(Boolean);
+}
 //# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3D,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAM;IAClC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAsB,yCAAyC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7H,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAChC,MAAM,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;gBAAE,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClF,MAAM,CAAC,CAAC,KAAK,CAAC,uEAAuE,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC;QACH,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAY,EAAE,CACvD,GAAG;KACA,KAAK,CAAC,QAAQ,CAAC;KACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KACtC,MAAM,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3D,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAM;IAClC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAsB,yCAAyC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7H,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAChC,MAAM,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;gBAAE,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClF,MAAM,CAAC,CAAC,KAAK,CAAC,uEAAuE,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC;QACH,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sIAAsI;AACtI,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;QACnE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC"}

package/dist/db/schema-auth.d.ts

@@ -0,0 +1,2 @@
+export declare const AUTH_MIGRATION = "\nALTER TABLE users ADD COLUMN email_verified BOOLEAN NOT NULL DEFAULT FALSE;\nALTER TABLE users ADD COLUMN image TEXT;\nALTER TABLE users ADD COLUMN created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP;\nALTER TABLE users ADD COLUMN updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP;\nALTER TABLE users ADD COLUMN two_factor_enabled BOOLEAN DEFAULT FALSE;\nUPDATE users SET email = lower(email), email_verified = TRUE, created_at = to_timestamp(created_ms / 1000.0), updated_at = to_timestamp(created_ms / 1000.0);\nCREATE TABLE accounts (\n  id TEXT NOT NULL PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL,\n  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, access_token TEXT, refresh_token TEXT, id_token TEXT,\n  access_token_expires_at TIMESTAMPTZ, refresh_token_expires_at TIMESTAMPTZ, scope TEXT, password TEXT,\n  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL\n);\nCREATE INDEX accounts_user_id_idx ON accounts (user_id);\nCREATE UNIQUE INDEX ux_accounts_provider_account ON accounts (provider_id, account_id);\nINSERT INTO accounts (id, account_id, provider_id, user_id, password, created_at, updated_at)\n  SELECT gen_random_uuid()::text, id, 'credential', id, password_hash, created_at, CURRENT_TIMESTAMP FROM users;\nALTER TABLE users DROP COLUMN password_hash;\nALTER TABLE users DROP COLUMN created_ms;\nDROP TABLE sessions;\nCREATE TABLE sessions (\n  id TEXT NOT NULL PRIMARY KEY, expires_at TIMESTAMPTZ NOT NULL, token TEXT NOT NULL UNIQUE,\n  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL, ip_address TEXT, user_agent TEXT,\n  user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE, active_org_id TEXT\n);\nCREATE INDEX sessions_user_id_idx ON sessions (user_id);\nALTER TABLE orgs ADD COLUMN logo TEXT;\nALTER TABLE orgs ADD COLUMN metadata TEXT;\nALTER TABLE orgs ADD COLUMN created_at TIMESTAMPTZ;\nUPDATE orgs SET created_at = to_timestamp(created_ms / 1000.0);\nALTER TABLE orgs ALTER COLUMN created_at SET NOT NULL;\nALTER TABLE orgs DROP COLUMN created_ms;\nALTER TABLE members ADD COLUMN id TEXT;\nALTER TABLE members ADD COLUMN created_at TIMESTAMPTZ;\nUPDATE members SET id = gen_random_uuid()::text, created_at = to_timestamp(created_ms / 1000.0);\nALTER TABLE members DROP CONSTRAINT members_pkey;\nALTER TABLE members ALTER COLUMN id SET NOT NULL;\nALTER TABLE members ALTER COLUMN created_at SET NOT NULL;\nALTER TABLE members DROP COLUMN created_ms;\nALTER TABLE members ADD PRIMARY KEY (id);\nCREATE UNIQUE INDEX ux_members_org_user ON members (org_id, user_id);\nCREATE INDEX members_org_id_idx ON members (org_id);\nCREATE INDEX members_user_id_idx ON members (user_id);\nDROP INDEX ix_members_user;\nALTER TABLE invites RENAME TO legacy_invites;\nCREATE TABLE invites (\n  id TEXT NOT NULL PRIMARY KEY, org_id TEXT NOT NULL REFERENCES orgs (id) ON DELETE CASCADE, email TEXT NOT NULL, role TEXT,\n  status TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,\n  inviter_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE\n);\nCREATE INDEX invites_org_id_idx ON invites (org_id);\nCREATE INDEX invites_email_idx ON invites (email);\nINSERT INTO invites (id, org_id, email, role, status, expires_at, created_at, inviter_id)\n  SELECT gen_random_uuid()::text, i.org_id, lower(i.email), i.role, 'pending', to_timestamp(i.expires_ms / 1000.0), to_timestamp(i.created_ms / 1000.0),\n    COALESCE((SELECT u.id FROM users u WHERE u.id = i.created_by),\n      (SELECT m.user_id FROM members m WHERE m.org_id = i.org_id AND m.role = 'owner' ORDER BY m.created_at LIMIT 1))\n  FROM legacy_invites i\n  WHERE i.accepted_ms IS NULL AND i.expires_ms > extract(epoch FROM CURRENT_TIMESTAMP) * 1000\n    AND EXISTS (SELECT 1 FROM members m WHERE m.org_id = i.org_id AND m.role = 'owner');\nDROP TABLE legacy_invites;\nCREATE TABLE verifications (\n  id TEXT NOT NULL PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TIMESTAMPTZ NOT NULL,\n  created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP\n);\nCREATE INDEX verifications_identifier_idx ON verifications (identifier);\nCREATE TABLE two_factors (\n  id TEXT NOT NULL PRIMARY KEY, secret TEXT NOT NULL, backup_codes TEXT NOT NULL, user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,\n  verified BOOLEAN, failed_verification_count INTEGER, locked_until TIMESTAMPTZ\n);\nCREATE INDEX two_factors_secret_idx ON two_factors (secret);\nCREATE INDEX two_factors_user_id_idx ON two_factors (user_id);\nCREATE TABLE passkeys (\n  id TEXT NOT NULL PRIMARY KEY, name TEXT, public_key TEXT NOT NULL, user_id TEXT NOT NULL REFERENCES users (id) ON DELETE CASCADE,\n  credential_id TEXT NOT NULL, counter INTEGER NOT NULL, device_type TEXT NOT NULL, backed_up BOOLEAN NOT NULL, transports TEXT,\n  created_at TIMESTAMPTZ, aaguid TEXT\n);\nCREATE INDEX passkeys_user_id_idx ON passkeys (user_id);\nCREATE INDEX passkeys_credential_id_idx ON passkeys (credential_id);\nCREATE TABLE rate_limits (id TEXT NOT NULL PRIMARY KEY, key TEXT NOT NULL UNIQUE, count INTEGER NOT NULL, last_request BIGINT NOT NULL);\nCREATE TABLE cloud_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);\nCREATE FUNCTION wl_org_keeps_owner() RETURNS trigger LANGUAGE plpgsql AS $$\nDECLARE oid TEXT := COALESCE(OLD.org_id, NEW.org_id);\nBEGIN\n  IF EXISTS (SELECT 1 FROM orgs WHERE id = oid) AND NOT EXISTS (SELECT 1 FROM members WHERE org_id = oid AND role = 'owner') THEN\n    RAISE EXCEPTION 'organization % must keep at least one owner', oid USING ERRCODE = 'check_violation';\n  END IF;\n  RETURN NULL;\nEND $$;\nCREATE CONSTRAINT TRIGGER members_keep_owner AFTER UPDATE OR DELETE ON members\n  DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION wl_org_keeps_owner();\n";
+//# sourceMappingURL=schema-auth.d.ts.map

package/dist/db/schema-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-auth.d.ts","sourceRoot":"","sources":["../../src/db/schema-auth.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,cAAc,8xLA0F1B,CAAC"}